RAACMinter::getUtilizationRate returns rate in wrong precision
Vulnerability Details
getUtilizationRate function is used inside RAACMinter::calculateNewEmissionRate to calculate new emission rate.
Returned value utitlizationRate is compared with utilizationTarget, the problem lies in there precision, utilizationTarget has the precision of 1e2 and utitlizationRate of 1e11, so utitlizationRate will always be higher than utilizationTarget.
utitlizationRate will be 1e11 as totalBorrowed is in 1e27 precision and totalDeposits will be in 1e18.
Impact
Wrong emission rate will be calculated for miniting raac tokens, as utitlizationRate will always be higher than utilizationTarget.
Tools Used
Manual Review
Recommendations
Return the utitlizationRate in same precision as utilizationTarget
Lead Judging Commences
RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics
RAACMinter::getUtilizationRate incorrectly mixes stability pool deposits with lending pool debt index instead of using proper lending pool metrics
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.